Buggy code:
final Map < String , ModelNode > directChildren = new HashMap < String , ModelNode > ( ) ; final Map < String , ModelNode > metrics = ( queryRuntime ) ? new HashMap < String , ModelNode > ( ) : Collections . < String , ModelNode > emptyMap ( ) ; final Map < String , ModelNode > otherAttributes = new HashMap < String , ModelNode > ( ) ; final Map < PathElement , ModelNode > childResources = ( recursive ) ? new LinkedHashMap < PathElement , ModelNode > ( ) : Collections . < PathElement , ModelNode > emptyMap ( ) ; final FilteredData localFilteredData = ( ( filteredData ) == null ) ? new FilteredData ( address ) : filteredData ; final ReadResourceHandler . ReadResourceAssemblyHandler assemblyHandler = new ReadResourceHandler . ReadResourceAssemblyHandler ( address , metrics , otherAttributes , directChildren , childResources , nonExistentChildTypes , localFilteredData ) ; context . addStep ( assemblyHandler , ( queryRuntime ? Stage . VERIFY : Stage . MODEL ) , true ) ; final ImmutableManagementResourceRegistration registry = context . getResourceRegistration ( ) ; final Resource resource = ReadResourceHandler . nullSafeReadResource ( context , registry ) ; final Map < String , Set < String > > childrenByType = ( registry != null ) ? GlobalOperationHandlers . getChildAddresses ( context , address , registry , resource , null ) : Collections . < String , Set < String > > emptyMap ( ) ; if ( ! attributesOnly ) { for ( Map . Entry < String , Set < String > > entry : childrenByType . entrySet ( ) ) { String childType = entry . getKey ( ) ; nonExistentChildTypes . add ( childType ) ; for ( String child : entry . getValue ( ) ) { PathElement childPE = PathElement . pathElement ( childType , child ) ; PathAddress absoluteChildAddr = address . append ( childPE ) ; ModelNode rrOp = Util . createEmptyOperation ( READ_RESOURCE_OPERATION , absoluteChildAddr ) ; PathAddress relativeAddr = PathAddress . pathAddress ( childPE ) ; if ( recursive ) { ImmutableManagementResourceRegistration childReg = registry . getSubModel ( relativeAddr ) ; if ( childReg == null ) { throw new OperationFailedException ( new ModelNode ( ) . set ( ControllerMessages . MESSAGES . noChildRegistry ( childType , child ) ) ) ; } boolean proxy = childReg . isRemote ( ) ; boolean runtimeResource = childReg . isRuntimeOnly ( ) ; boolean getChild = ( ( ! runtimeResource ) || ( queryRuntime && ( ! proxy ) ) ) || ( proxies && proxy ) ; if ( ( ! aliases ) && ( childReg . isAlias ( ) ) ) { nonExistentChildTypes . remove ( childType ) ; getChild = false ; } if ( getChild ) { nonExistentChildTypes . remove ( childType ) ; final int newDepth = ( recursiveDepth > 0 ) ? recursiveDepth - 1 : 0 ; rrOp . get ( RECURSIVE ) . set ( operation . get ( RECURSIVE ) ) ; rrOp . get ( RECURSIVE_DEPTH ) . set ( newDepth ) ; rrOp . get ( PROXIES ) . set ( proxies ) ; rrOp . get ( INCLUDE_RUNTIME ) . set ( queryRuntime ) ; rrOp . get ( INCLUDE_ALIASES ) . set ( aliases ) ; rrOp . get ( INCLUDE_DEFAULTS ) . set ( defaults ) ; ModelNode rrRsp = new ModelNode ( ) ; childResources . put ( childPE , rrRsp ) ; OperationStepHandler overrideHandler = childReg . getOperationHandler ( EMPTY_ADDRESS , opName ) ; if ( ( overrideHandler != null ) && ( ( overrideHandler . getClass ( ) ) == ( getClass ( ) ) ) ) { overrideHandler = null ; } OperationStepHandler rrHandler = new ReadResourceHandler ( localFilteredData , overrideHandler ) ; context . addStep ( rrRsp , rrOp , rrHandler , MODEL , true ) ; } } else { AuthorizationResult ar = context . authorize ( rrOp , EnumSet . of ( ADDRESS ) ) ; if ( ( ar . getDecision ( ) ) == ( Decision . DENY ) ) { <START_BUG> filteredData . addAccessRestrictedResource ( absoluteChildAddr ) ; <END_BUG> } else { ModelNode childMap = directChildren . get ( childType ) ; if ( childMap == null ) { nonExistentChildTypes . remove ( childType ) ; childMap = new ModelNode ( ) ; childMap . setEmptyObject ( ) ; directChildren . put ( childType , childMap ) ; } childMap . get ( child ) ; } } } } } final Set < String > attributeNames = ( registry != null ) ? registry . getAttributeNames ( EMPTY_ADDRESS ) : Collections . < String > emptySet ( ) ; for ( final String attributeName : attributeNames ) { final AttributeAccess access = registry . getAttributeAccess ( EMPTY_ADDRESS , attributeName ) ; if ( ( aliases || ( ! ( access . getFlags ( ) . contains ( ALIAS ) ) ) ) && ( queryRuntime || ( ( access . getStorageType ( ) ) == ( Storage . CONFIGURATION ) ) ) ) { Map < String , ModelNode > responseMap = ( ( access . getAccessType ( ) ) == ( AccessType . METRIC ) ) ? metrics : otherAttributes ; addReadAttributeStep ( context , address , defaults , localFilteredData , registry , attributeName , responseMap ) ; } } final ModelNode model = resource . getModel ( ) ; if ( model . isDefined ( ) ) { for ( String key : model . keys ( ) ) { if ( ( ( ! ( otherAttributes . containsKey ( key ) ) ) && ( ! ( childrenByType . containsKey ( key ) ) ) ) && ( ! ( metrics . containsKey ( key ) ) ) ) { addReadAttributeStep ( context , address , defaults , localFilteredData , registry , key , otherAttributes ) ; }

Fix:
localFilteredData . addAccessRestrictedResource ( absoluteChildAddr ) ;